cclohmar/zoraxy-dhcp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: use systemctl directly with CAP_SYS_ADMIN capability instead of sudo (broken by NoNewPrivileges)

Browse source
This commit is contained in:
Claus Lohmar 2026-07-25 18:26:40 +00:00
parent da01893aa3
commit 6554078246
2 changed files with 15 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
install.sh
View file

@ -462,6 +462,14 @@ ExecStart=/opt/zoraxy/zoraxy -plugin=/opt/zoraxy/plugins
Restart=on-failure Restart=on-failure
RestartSec=5 RestartSec=5
# Security hardening
ProtectSystem=full
PrivateTmp=true
# Capabilities: bind low ports + talk to systemd for plugin reloads
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SYS_ADMIN
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_SYS_ADMIN
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target
ZORAXY_SVC ZORAXY_SVC
@ -533,15 +541,11 @@ install_plugin() {
# Set group on plugin binary dir # Set group on plugin binary dir
chgrp -R "$group" "$plugin_dir" 2>/dev/null || true chgrp -R "$group" "$plugin_dir" 2>/dev/null || true
# Sudoers for reload # Note: reload uses Linux capabilities (CAP_SYS_ADMIN), not sudo.
local sudoers_file="/etc/sudoers.d/dnsmasq-edit" # The Zoraxy systemd service must include:
if [ ! -f "$sudoers_file" ]; then # CapabilityBoundingSet=CAP_SYS_ADMIN
cat > "$sudoers_file" << 'SUDO_EOF' # AmbientCapabilities=CAP_SYS_ADMIN
# Allow dnsmasq-edit group to reload dnsmasq without a password # (already configured by this installer).
%dnsmasq-edit ALL=(root) NOPASSWD: /usr/bin/systemctl reload dnsmasq, /usr/bin/systemctl restart dnsmasq, /usr/sbin/service dnsmasq reload, /usr/sbin/service dnsmasq restart
SUDO_EOF
chmod 0440 "$sudoers_file"
fi
log "Plugin installed at: $plugin_dir" log "Plugin installed at: $plugin_dir"
} }

4
server.go
View file

@ -24,8 +24,8 @@ var (
// Override via environment: LEASE_FILE, CONF_FILE, RELOAD_CMD, RELOAD_ARGS // Override via environment: LEASE_FILE, CONF_FILE, RELOAD_CMD, RELOAD_ARGS
leasesFile = envOrDefault("LEASE_FILE", "/opt/zoraxy/conf/dhcp/dnsmasq.leases") leasesFile = envOrDefault("LEASE_FILE", "/opt/zoraxy/conf/dhcp/dnsmasq.leases")
confFile = envOrDefault("CONF_FILE", "/opt/zoraxy/conf/dhcp/dnsmasq.conf") confFile = envOrDefault("CONF_FILE", "/opt/zoraxy/conf/dhcp/dnsmasq.conf")
reloadCmd = envOrDefault("RELOAD_CMD", "sudo") reloadCmd = envOrDefault("RELOAD_CMD", "/usr/bin/systemctl")
reloadArgs = strings.Fields(envOrDefault("RELOAD_ARGS", "systemctl reload dnsmasq")) reloadArgs = strings.Fields(envOrDefault("RELOAD_ARGS", "reload dnsmasq"))
) )
func envOrDefault(key, fallback string) string { func envOrDefault(key, fallback string) string {